JP2010218267A - Obstacle occurrence probability calculation system, obstacle occurrence probability calculation method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an obstacle occurrence probability calculation system, an obstacle occurrence probability calculation method and an obstacle occurrence probability calculation program, for calculating the probability of the occurrence of an obstacle due to the operation of a user among the obstacles of a computer system. <P>SOLUTION: An obstacle time operation featured value calculation means 16 classifies an execution command history when the obstacle of a computer system occurs into a plurality of categories, and calculates an obstacle time operation featured value based on the calculation result, and stores it in an obstacle time data storage part 17. An operation featured value calculation means 20 calculates an evaluation target operation featured value in the same way as the obstacle time operation featured value calculation means 16 from the execution command history of the evaluation target computer system, and a number of obstacle calculation means 21 calculates the number of obstacle time operation featured values which are equal or approximate to the evaluation target operation featured value by retrieving information stored in the failure time data storage part 17, and an obstacle occurrence probability calculation means 25 calculates the obstacle occurrence probability of the evaluation target computer system based on the calculated number. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a failure occurrence probability calculation system that calculates a failure occurrence probability of a computer system based on information related to the computer system.

  Computer systems that perform information processing are used as systems that provide services in various fields. For example, to efficiently execute financial transactions, traffic operation control, administrative services, in-house information management, etc. It is used as a system.

  However, while the range of use of computer systems has expanded due to the high performance of computers, computer systems have become the business foundation, so when a problem occurs in a computer system, the work is stopped or delayed. There is a concern that damage will occur.

  For this reason, an organization that uses a computer system asks a contractor to perform maintenance and management of the system to perform quick recovery in the event of a system failure, periodic system inspections, software updates, etc. Is common.

  The maintenance fee charged by the system maintenance management company to the user organization of this system is often a fixed percentage of the development cost of the system. Since it differs from system to system, it is appropriate to estimate the maintenance fee individually. For this purpose, a technique for appropriately calculating the failure rate of the system is necessary.

  Here, techniques related to maintenance of a computer system are disclosed in Patent Document 1 and Patent Document 2. Patent Document 1 includes a failure information database that stores sample data including a phenomenon category, a factor category, and an inoperative time for each of a plurality of failures that have occurred in the past in the computer system, and a combination of the phenomenon category and the factor category. In the future, we calculate the total downtime, which is the sum of the downtime, based on the downtime due to, and use the linear probability calculation based on the combination of the phenomenon and factor categories and the total downtime. A failure prediction function unit that calculates a combination of a phenomenon category and a factor category in which a failure occurs, a failure occurrence date and a failure occurrence probability, and stores the failure occurrence probability, and stores the failure prediction database, and a failure prediction stored in the failure prediction database A failure prediction system comprising a failure occurrence high probability notification function unit for notifying a preset destination when the failure probability of data exceeds a preset threshold value Beam is disclosed.

  Patent Document 2 collects information about the operating state of a computer system, records correlation information indicating the correlation between the collected information, refers to the correlation information, and uses the collected information to A computer that detects a failure in a service to be executed, generates a process for recovering the detected failure, refers to the correlation information, and / or executes the generated process and / or the input process. A computer system control method is disclosed in which an effect and an influence given to a system are determined, and at least one of execution necessity, execution order, and execution time of a process for which the effect and influence are determined is determined.

Japanese Patent Application No. 2007-199976 Japanese Patent Application No. 2008-9842

  However, in the technologies disclosed in Patent Documents 1 and 2, among the failures that are expected to occur in the computer system, failures caused by software or hardware problems can be identified because the system outputs related information. However, there is an inconvenience that a failure caused by an operation error of the system user cannot be determined. For this reason, in the evaluation of the system, it was not possible to consider how to operate in the field.

  In order to detect a failure caused by a user's operation error, there is a method of monitoring the user's operation using a camera or a sensor. However, monitoring the user with a camera or the like violates the privacy of the user. In addition, it was not realistic to attach a sensor because it may cause a sense of disgust.

  Therefore, the present invention solves the problems in each related technology described above, calculates the occurrence probability of a computer system failure caused by a user's operation, and makes it possible to effectively maintain the system. It is an object of the present invention to provide a system, a failure occurrence probability calculation method, and a failure occurrence probability calculation program.

  In order to achieve the above object, a failure occurrence probability calculation system according to the present invention includes command collection means for collecting command history information indicating execution commands and execution dates and times of monitored computer systems, and the collected command history information. A command accumulating unit for accumulating; a fault detecting means for detecting a fault in the computer system to be monitored; and when the fault detecting means detects a fault in the computer system, the computer for a certain period immediately before the occurrence of the fault Command history extraction means for extracting a command history executed by the system from the command storage unit, and commands included in the extracted command history are classified into a plurality of preset categories, and the classification result is obtained. Based on this, the operation feature value at the time of failure representing the feature of the command history is calculated. Failure operation characteristic value calculating means, a failure data storage unit for storing the calculated failure operation feature value, and an execution command history of the computer system to be evaluated are inputted, and the command history is used as the failure operation feature value The operation feature value calculation means for calculating the evaluation target operation feature value representing the feature of the command history by performing analysis processing in the same manner as the calculation means, and the failure that is the same as or within the approximate range of the calculated evaluation target operation feature value Based on the number of failure operation characteristic values calculated by the failure number calculation means calculated by the failure number calculation means for searching the information accumulated in the failure data storage unit and calculating the number of operation characteristic values at the time of failure Fault occurrence probability calculating means for calculating the failure occurrence probability of the computer system to be evaluated.

  Further, the failure occurrence probability calculation method of the present invention includes a command collection unit that collects an execution command of a monitoring target computer system and command history information indicating the execution date and stores the command history information in a command storage unit. When a failure is detected by the failure detection means and a failure of the computer system is detected, a history of commands executed by the computer system during a certain period immediately before the occurrence of the failure is obtained by the command history extraction means at the time of failure. The command extracted from the storage unit, the commands included in the extracted command history are classified into a plurality of preset categories, and the operation characteristic value at the time of failure representing the feature of the command history based on the classification result is displayed at the time of failure. Computer calculated by the operation feature value calculation means, accumulated in the data storage unit at the time of failure, and evaluated The operation feature value calculation means inputs the execution command history of the stem and performs analysis processing in the same manner as the operation feature value calculation means at the time of failure to calculate the evaluation target operation feature value representing the feature of the command history, and the calculated The failure number calculation means searches the information accumulated in the failure data storage unit to calculate the number of failure operation feature values that are the same as or within the approximate range of the evaluation target operation feature value, and the calculated failure The failure occurrence probability calculating means calculates a failure occurrence probability of the computer system to be evaluated based on the number of hourly operation feature values.

  The failure occurrence probability calculation program of the present invention includes a command collection function for collecting commands executed in the system from the monitored computer system side and command history information indicating the execution date and storing the command history information in a storage device, A failure detection function for detecting a failure of the computer system to be monitored, and a history of commands executed by the computer system during a certain period immediately before the occurrence of the failure when the failure detection function detects a failure of the computer system Command extraction function at the time of failure from the storage device, and commands included in the extracted command history are classified into a plurality of preset categories, and the characteristics of the command history are expressed based on the classification result Calculation of faulty operation feature values by calculating faulty operation feature values and storing them in the storage device An evaluation for calculating an evaluation target operation feature value representing a feature of the command history by inputting a function and an execution command history of the computer system to be evaluated and analyzing the command history in the same manner as the failure operation feature value calculation function The target operation feature value calculation function, and the number of failures calculation by searching the information stored in the storage device to calculate the number of failure operation feature values that are the same as or within the approximate range of the calculated evaluation target operation feature value The computer is caused to execute a function and a failure occurrence probability calculation function for calculating a failure occurrence probability of the computer system to be evaluated based on the calculated number of operation characteristic values at the time of failure.

  Since the present invention is configured as described above, it calculates and accumulates a failure operation feature value representing the feature from the execution command history at the time of failure of the monitored system, and based on this Since the failure occurrence probability of the evaluation target system is calculated as described above, it is possible to effectively calculate the failure occurrence probability of the computer system resulting from the user's operation, and the operation contents performed on the computer system Therefore, it is possible to appropriately perform maintenance of the computer system in consideration of its operation status.

It is a functional block diagram which shows the structure of the failure occurrence probability calculation system of one Embodiment concerning this invention. It is a figure which shows an example of the command history memorize | stored in the command storage part in embodiment disclosed in FIG. It is a figure which shows an example of the command history memorize | stored in the data storage part at the time of failure in embodiment disclosed in FIG. It is a figure which shows an example of the failure number distribution table created by the failure number distribution table preparation means in embodiment disclosed in FIG. It is a figure which shows an example of the monitoring object information memorize | stored in the monitoring object information storage part in embodiment disclosed in FIG. It is a flowchart which shows the command collection operation | movement of the failure occurrence probability calculation system of embodiment disclosed in FIG. It is a flowchart which shows the failure detection operation | movement of the failure occurrence probability calculation system of embodiment disclosed in FIG. It is a flowchart which shows the failure occurrence probability calculation operation | movement of the failure occurrence probability calculation system of embodiment disclosed in FIG.

  Hereinafter, an embodiment according to the present invention will be described with reference to the drawings.

  FIG. 1 is a functional block diagram illustrating a configuration of a failure occurrence probability calculation system 1 according to the present embodiment. As shown in FIG. 1, the failure occurrence probability calculation system 1 of the present embodiment includes an interface unit 11 connected to monitored computer systems 2-1 to 2-n (n is a natural number), and a monitored computer system 2- The command collection means 12 that periodically accesses 1-2 -n and collects command history information indicating the execution commands and execution dates and times of the computer systems 2-1 to 2-n, and stores the collected command history information And a command storage unit 13 for performing the above operation.

  Furthermore, the failure occurrence probability calculation system 1 of this embodiment includes failure detection means 14 that periodically accesses the monitored computer systems 2-1 to 2-n and detects failures in the computer systems 2-1 to 2-n. When a failure of the computer systems 2-1 to 2-n is detected by the failure detection means 14, the history of execution commands for a certain time immediately before the occurrence of the failure in the computer system in which the failure has occurred is stored as a command. A command history extraction means 15 for failure extraction from the information stored in the unit 13 and a command classification process for classifying the commands included in the extracted command history for a certain period into a plurality of preset categories. Execute the failure operation feature value to calculate the failure operation feature value representing the feature of the command history based on the classification result Stage 16, a failure time data storage unit 17 for storing the calculated failure operation feature value, and a plurality of numerical areas in which the failure operation feature value calculated by the failure operation feature value calculation unit 16 is preset. And a failure number distribution table creation means 26 for creating a failure number distribution table showing the number of operation feature values at the time of failure for each numerical region and storing the failure number distribution table in the failure data storage unit 17. ing.

  Furthermore, the failure occurrence probability calculation system 1 according to the present embodiment externally inputs a failure occurrence probability calculation command at a designated date and time of the evaluation target computer system that is one of the computer systems 2-1 to 2-n. The information input unit 18 to be executed, the evaluation target command extraction means 19 for extracting the history of the execution command of the evaluation target computer system from the command storage unit 13 at a predetermined time immediately before the date and time designated in accordance with this command, and the extracted fixed period The operation feature value calculating means 20 for calculating the evaluation target operation feature value by analyzing the command history of the minute in the same manner as the failure operation feature value calculating means 16, and the same or approximate range of the calculated evaluation target operation feature value Failure number calculation means 2 for searching the information accumulated in the failure time data storage unit 17 and calculating the number of failure operation feature values in the failure It is equipped with a door.

Furthermore, the failure occurrence probability calculation system 1 according to the present embodiment is a monitoring target information registration unit 22 that acquires monitoring target information indicating the identification information of the monitoring target computer systems 2-1 to 2-n and the monitoring start date and time. A monitoring target information storage unit 23 for storing the monitoring target information, a parameter calculating means 24 for calculating the total monitoring period of the entire monitoring target computer system based on the monitoring target information as a total monitoring period, A failure occurrence that calculates a value obtained by dividing the number calculated by the number calculation unit 21 by the number calculated by the parameter calculation unit 24 as a failure occurrence probability at the specified date and time of the evaluation target computer system and outputs the failure occurrence probability to the host system 3 Probability calculation means 25 is provided.
Here, the command collection unit 12, the command storage unit 13, the failure detection unit 14, the failure command history extraction unit 15, the failure operation feature value calculation unit 16, the failure data storage unit 17, and the number of failures The distribution table creation means 26 becomes a failure occurrence probability calculation database creation system, and further includes an information input unit 18, a command history extraction unit 19, an operation feature value calculation unit 20, a failure data storage unit 17, and a failure The number calculation means 21, the parameter calculation means 24, and the failure occurrence probability calculation means 25 constitute a failure occurrence probability calculation device.

  Each of the computer systems 2-1 to 2-n to be monitored is a system equipped with an operating system (OS) of the same system, for example, a server equipped with a UNIX (registered trademark) OS. Each of the computer systems 2-1 to 2-n has a function of taking a command execution history.

  The command collection means 12 in the failure probability calculation system 1 periodically accesses each of the computer systems 2-1 to 2-n, and executes command history information recorded on the computer systems 2-1 to 2-n side. Is acquired and sent to the command storage unit 13. Here, the command history information is information including at least an execution command, an execution date and time, and identification information of the computer system that executed the command.

  The command information storage unit 13 stores the command history information sequentially collected by the command collection unit 12. FIG. 2 is a diagram illustrating an example of an image of command history information stored in the command information storage unit 13. As shown in FIG. 2, the command history information stored in the command information storage unit 13 includes an “identification ID” that is an identifier of the command information numbered by the command collecting unit 12 and an identification of the computer system that executed the command. This is information indicating the “execution system ID” that is information, the “execution command” that is the executed command, and the “execution date and time” that is the execution date and time thereof in association with each other. The command history information shown in FIG. 2 is an example when the computer systems 2-1 to 2-n are systems in which a UNIX (registered trademark) OS is installed.

  The failure detection means 14 has a function of periodically accessing each of the computer systems 2-1 to 2-n and detecting a failure that has occurred in the computer systems 2-1 to 2-n.

  When a failure is detected by the failure detection unit 14, the failure time command history extraction unit 15 inputs identification information of the computer system (2-1 to 2-n) in which the failure has occurred. A function for extracting a command history corresponding to the identification information for a certain period immediately before the occurrence of the failure from the information stored in the command storage unit 14 is provided. Here, the execution command for a predetermined period is a command executed for a predetermined period set in advance, for example, a command executed within one hour or an execution command for 100 times may be set. .

  The failure operation feature value calculation means 16 executes a command classification process for classifying the commands included in the command history for a certain period of time extracted by the failure command history extraction means 15 by category, and by this classification process. This is means for calculating an operation feature value at the time of failure based on the classification result. The failure operation feature value calculation means 16 refers to a data table (not shown) showing all commands that can be executed by the computer systems 2-1 to 2 -n by category, and according to this data table for a certain period of time. At least one of a function for executing command classification processing for classifying commands included in the command history by category and the number of commands in each category as a result of the command classification processing is calculated as an operation characteristic value at the time of failure. With functionality. Thereby, the operation tendency at the time of failure of a computer system can be quantified.

For example, the command classification process is a process for classifying commands into three categories: a reference command for referring to system information / status, a change command for changing system information / status, and other commands. I just need it. If the computer system to be monitored is a UNIX machine, among the UNIX commands, set "ifconfig", "vmstat", "top", "ps", etc. as reference commands, and "ifup", "ifdown", It is preferable to set “chmod”, “chown”, etc. to the change command, and to calculate two values of the reference command number and the change command number as the operation characteristic value at the time of failure.
This is a command for the reference command to display information about the system and allow the user to browse, and since the change command is a command for changing the system status setting, when the system executes the reference command, the system The number of reference commands and the number of change commands are the same as the number of reference commands and change commands are high because there is a high possibility that a setting error or operation error will occur when the system executes a change command. This is because it can be said that it represents the possibility that a mistake has occurred.

  The failure-time data storage unit 17 stores the failure-time operation feature value calculated by the failure-time operation feature value calculation unit 16. FIG. 3 is a diagram illustrating an example of the failure operation feature value stored in the failure data storage unit 17. In FIG. 3, the two values of the reference command number and the change command number described above are the operation characteristic values at the time of failure.

  As shown in FIG. 3, the list of failure operation feature values stored in the failure data storage unit 17 is an identifier of failure operation feature values numbered by the failure operation feature value calculation means 16. “ID”, “reference command number” and “change command number” that are operation characteristic values at the time of failure, and “occurrence date and time” that is the date and time when the failure occurred are shown in association with each other.

  The failure number distribution table creating means 26 is activated in advance when the failure operation feature value calculating means 16 calculates the failure operation feature value or periodically and stored in the failure data storage unit 17 in advance. A failure number distribution table showing the numbers in each numerical area when a failure operation feature value related to a failure that occurred during the set determination period is distributed to a plurality of numerical areas is created in the failure data storage unit 17. It has a function to memorize. This failure number distribution table is data in which a plurality of numerical areas are associated with the accumulated number of failure operation feature values applicable to each numerical area. FIG. 4 is a diagram illustrating an example of the failure number distribution table. FIG. 4 is a failure distribution table in the case where the two values of the reference command number and the change command number described above are used as operation characteristic values at the time of failure.

  In the failure number distribution table shown in FIG. 4, each numerical area of “number of reference commands” is plotted on the horizontal axis and each numerical area of “number of changed commands” is plotted on the vertical axis. Show.

  Further, the failure number distribution table creating means 26, when there is a numerical region (blank region) having no operation characteristic value at the time of failure applicable in the failure number distribution table, the number of numerical values in the numerical region adjacent to the blank region is calculated. It has a function of calculating an average and completing the failure number distribution table using the calculated average value as an estimated value of a blank area. For example, in the case of the table shown in FIG. 4, the average of the values of the upper and lower four adjacent regions may be used as the estimated value.

As described above, the failure number distribution table creation unit 26 creates the failure number distribution table in advance, so that the failure number calculation unit 21 determines the number of failure operation feature values that are the same as or approximate to the evaluation target operation feature value as the failure number distribution. It can be quickly calculated from the table.
Here, the failure-time operation feature value calculation means 16 relates to a new failure so that the failure-time operation feature value related to the failure that has occurred within a preset determination period is stored in the failure-time data storage unit 17. When sending the operation characteristic value at the time of failure to the data storage unit 17 at the time of failure, the old information exceeding the determination period may be deleted from the data storage unit 17 at the time of failure. As a result, past data for the determination period is accumulated in the failure data storage unit 17, so the failure number distribution table creation unit 26 performs all failure operation stored in the failure data storage unit 17. If the failure number distribution table is created from the feature values, the failure number distribution table relating to the failure within the determination period is automatically completed.

  The information input unit 18 inputs a failure occurrence probability calculation command. Here, the failure occurrence probability calculation command includes the identification information of the computer system to be evaluated (any one of 2-1 to 2-n) and the designated date and time. The information input unit 18 includes an input device that receives a user's operation such as a keyboard or a mouse, and is configured to input a failure occurrence probability calculation command in accordance with the user's operation.

  Based on the identification information included in the failure occurrence probability calculation command input to the information input unit 18 and the specified date and time, the command history extraction unit 19 corresponds to this identification information and is fixed immediately before the specified date and time. A function for extracting command history for a period from information stored in the command storage unit 16 is provided. Here, as described above, the command history for a certain period may be set as, for example, a command executed within one hour or an execution command for 100 times.

  The operation feature value calculation means 20 executes the command classification process for classifying the commands included in the command history for a certain period of time extracted by the command history extraction means 19 according to the category, and the classification result by the classification process. Is a means for calculating a faulty operation feature value based on Thereby, the operation tendency of the computer system to be evaluated can be quantified.

  The operation feature value calculation means 20 is a data table (not shown) that shows all commands that can be executed by the computer systems 2-1 to 2-n classified by category, similar to the operation feature value calculation means 16 at the time of failure. Of the command classification process for classifying the commands included in the command history for a certain period according to this data table, and the number of commands in each category as a result of this command classification process. And a function of setting at least one command number as an operation feature value at the time of failure.

  The failure number calculation means 21 inputs the evaluation target operation feature value calculated by the operation feature value calculation means 20, and calculates the number of failure operation feature values that are the same as or within the approximate range of the evaluation target operation feature value. It is a means for searching and calculating information stored in the data storage unit 17. The failure number calculation unit 21 of the present embodiment refers to the failure number distribution table stored in the failure time data storage unit 17, and a numerical area to which the evaluation target operation feature value calculated by the operation feature value calculation unit 20 applies. It is comprised so that the number in may be read. According to the failure number calculation means 21, it is possible to calculate the number of times that a failure has occurred within the above-described determination period by an operation similar to the operation content of the computer system to be evaluated.

  The monitoring target information acquisition unit 22 acquires monitoring target information indicating the identification information of the monitoring target computer systems 2-1 to 2-n and the monitoring start date and time and stores the monitoring target information in the monitoring target information storage unit 23. is there.

  The monitoring target information storage unit 23 has a function of storing the monitoring target information acquired by the monitoring target information acquisition unit 22. FIG. 5 is a diagram illustrating an example of an image of the monitoring target information stored in the monitoring target information storage unit 23. As shown in FIG. 5, the monitoring target information includes “identification ID” that is an identifier of monitoring target information numbered by the monitoring target information collecting unit 22 and “contractor ID” that is an identifier of a computer system to be monitored. And the “system name” that is the system name of this computer system and the “registration date and time” that is the date and time when monitoring of this computer system is started.

  The parameter calculation means 24 is a means for calculating the total monitoring period of the entire monitoring target computer system in the above-described determination period as a total monitoring period based on the monitoring target information stored in the monitoring target information storage unit 23. It is. For example, when there are three computer systems to be monitored and the monitoring target information related to the three systems is stored in the monitoring target information storage unit 23, the current date and time is December 5th, and the determination period is from December 1st to If the registration date / time of system A is December 1st, the registration date / time of system B is December 3rd, and the registration date / time of system C is December 5th as 5 days of 5th, the monitoring period of system A is 5 As a day, the monitoring period of the system B is 3 days, the monitoring period of the system C is 1 day, and the total monitoring period is 5 + 3 + 1 = 9 days.

  According to the parameter calculation means 24, even when there are a plurality of computer systems to be monitored and the monitoring start dates and times are different, the total monitoring period can be calculated.

  The failure occurrence probability calculation unit 25 calculates a value obtained by dividing the number calculated by the failure number calculation unit 21 by the number calculated by the parameter calculation unit 24 as a failure occurrence probability at a specified date and time of the evaluation target computer system. A function for outputting to the host system 3 is provided.

  According to the failure occurrence probability calculating means 25, the number of occurrences per failure during the unit period (in the above example, one day) where the failure actually occurs is the same or similar to the operation trend of the computer system to be evaluated. It can be calculated as a probability. Here, the reason for designating the determination period is to calculate an accurate probability corresponding to the case where the generation of the operator of the computer system changes with the changing times.

  As described above, the failure occurrence probability calculation system 1 according to the present embodiment includes the failure command history extraction unit 15 that extracts the execution command history when a failure occurs in the monitoring system from the information stored in the command storage unit 13, and the failure occurrence. The failure operation feature value calculation means 16 that calculates the failure operation characteristic value by calculating the failure operation tendency based on the execution command history at the time and accumulates it in the failure data storage unit 17, and the evaluation target computer system The evaluation target operation feature value calculating unit 20 that calculates the evaluation target operation feature value from the execution command history, and the number of failure operation feature values that are the same as or similar to the evaluation target operation feature value are stored in the failure data storage unit 17. The failure number calculating means 21 for searching and calculating information, and the failure occurrence probability of the computer system to be evaluated based on the number of operation characteristic values at the time of failure are calculated. And a failure probability calculation means 25 and out.

  Therefore, according to the failure occurrence probability calculation system 1 of the present embodiment, it is possible to calculate the number of system failures that have occurred with a command history that is the same as or similar to the history of commands input to the computer system to be evaluated, and use it in a computer system. It is possible to calculate the probability that a failure will occur due to the user's operation.

  Next, the operation of the failure occurrence probability calculation system 1 of the present embodiment will be described. Here, the following description of the operation is one embodiment of the failure occurrence probability calculation method of the present invention.

  FIG. 6 is a flowchart showing the command collection operation of the failure occurrence probability calculation system 1 of this embodiment. As shown in FIG. 6, in the command collection operation of the failure occurrence probability calculation system 1, first, the command collection unit 12 determines whether or not the monitoring time set in advance at a predetermined interval has been reached (step S61 in FIG. 6). . When the command collection unit 12 determines that the monitoring time has come, the computer system 2-1 to 2-n to be monitored is accessed (step S62 in FIG. 6). Then, the command collection unit 12 acquires an execution command history from the monitored computer systems 2-1 to 2-n that have been accessed (step S63 in FIG. 6), and sends the execution command history to the command storage unit 13. The history is stored (step S64 in FIG. 6).

  Subsequently, the command collecting unit 12 determines whether or not all the monitored computer systems 2-1 to 2-n have been accessed (step S65 in FIG. 6). Exit.

  FIG. 7 is a flowchart showing the failure detection operation of the failure occurrence probability calculation system 1 of the present embodiment. As shown in FIG. 7, in the failure detection operation of the failure occurrence probability calculation system 1, the failure detection means 14 first determines whether or not the monitoring time set in advance at a predetermined interval has come (step S71 in FIG. 7). . When the failure detection unit 14 determines that the monitoring time has come, the computer system 2-1 to 2-n to be monitored is accessed (step S72 in FIG. 7).

  Subsequently, the failure detection means 14 determines whether or not a failure has occurred in the accessed computer systems 2-1 to 2-n (step S73 in FIG. 7). When a failure is detected, the failure detection means 14 acquires the identification information and failure occurrence time of the computer system (2-1 to 2-n) where the failure has occurred, and sends it to the failure command history extraction means 15. The command history extraction means 15 at the time of failure extracts the history of commands executed by the computer system related to the identification information during a certain period immediately before the failure occurrence time based on the identification information from the command information stored in the command storage unit 13 (Step S74 in FIG. 7).

  Subsequently, a command classification process in which the failure operation feature value calculation unit 16 classifies commands included in the command history for a certain period extracted by the failure command history extraction unit 15 into a plurality of preset categories. And an operation characteristic value at the time of failure is calculated based on the classification result (step S75 in FIG. 7). The failure-time operation feature value is stored in the failure-time data storage unit 17 (step S76 in FIG. 7).

  The failure number distribution table creating means 26 divides all failure operation feature values accumulated in the failure time data storage unit 17 into a plurality of numerical regions and creates a failure number distribution table indicating the number of each numerical region. It is stored in the hour data storage unit 17 (step S77 in FIG. 7).

  Subsequently, the failure detection means 14 determines whether or not all of the monitored computer systems 2-1 to 2-n have been accessed (step S78 in FIG. 7). Exit.

  FIG. 8 is a flowchart showing the failure occurrence probability calculation operation of the failure occurrence probability calculation system 1 of the present embodiment. As shown in FIG. 8, in the failure occurrence probability calculation operation of the failure occurrence probability calculation system 1, first, the information input unit 18 uses the identification information of the computer system to be evaluated (any one of 2-1 to 2-n) and A failure occurrence probability calculation command including the designated date and time is input (step S81 in FIG. 8), and the command history extraction means 19 is in accordance with the failure occurrence probability calculation command and is constant before the designated date and time in the computer system to be evaluated. The execution command history for the period is extracted from the command storage unit 13 based on the identification information and sent to the operation feature value calculation unit 20 (step S82 in FIG. 7), and the operation feature value calculation unit 20 evaluates based on the command history. A target feature value is calculated (step S83 in FIG. 7).

  Subsequently, the failure count calculation unit 21 accumulates in the failure data storage unit 17 the number of failure operation feature values that are the same as or within the approximate range of the evaluation target operation feature values calculated by the operation feature value calculation unit 20. The obtained information is searched and calculated (step S84 in FIG. 7). Specifically, the number of numerical areas to which the evaluation target operation feature value applies is read with reference to the failure number distribution table stored in the failure data storage unit 17.

  The failure occurrence probability calculation unit 25 that has received the number of failures from the failure number calculation unit 21 transmits a total monitoring period calculation instruction to the parameter calculation unit 24, and the parameter calculation unit 24 that has received the instruction stores the monitoring target information storage. The total monitoring period is calculated based on the monitoring target information stored in the unit 23 (step S85 in FIG. 7) and sent to the failure occurrence probability calculating means 25.

  Then, the failure occurrence probability calculation unit 25 calculates a value obtained by dividing the number calculated by the failure number calculation unit 21 by the number calculated by the parameter calculation unit 24 as the failure occurrence probability of the computer system to be evaluated ( Step S86 in FIG. 7 is output to the host system 3.

  Here, in the failure occurrence probability calculation system 1 of the present embodiment, the command collection means 12, the failure detection means 14, the failure time command history extraction means 15, the failure time operation feature value calculation means 16, the command history extraction means 19, the operation feature value. The calculation means 20, the failure number calculation means 21, the monitoring target acquisition means 22, the parameter calculation means 24, and the failure occurrence probability calculation means 25 may be configured such that the function content is programmed and executed by a computer. In this case, the command storage unit 13, the failure storage unit 17, and the monitoring target information storage unit 23 are configured to be executed by an auxiliary storage device attached to the computer.

  In the above description, the information input unit 18 inputs a probability calculation command, and the operation feature value calculation unit 20 extracts the command history to be evaluated from the command storage unit 13 according to the command and sends it to the operation feature value calculation unit 20. However, the present invention is not limited to this, and the information input unit 18 inputs a command including an execution command history for a certain period of the computer system to be evaluated so that the operation feature value calculation means 20 directly receives the command history. It may be configured. By configuring in this way, another computer system that is not one of the monitoring target systems 2-1 to 2-n can be set as the evaluation target computer system.

  In addition, the information input unit 18 is configured to input information according to a user's operation. However, the information input unit 18 is not limited thereto, and may be configured to connect to the host system 3 and input a command. .

  As described above, the failure occurrence probability calculation system 1 according to the present embodiment calculates and accumulates failure-time operation feature values representing operation tendency at the time of failure based on the execution command history at the time of failure of the monitoring system. In addition, the evaluation target operation feature value is calculated from the execution command history of the evaluation target computer system, and the evaluation target computer system is based on the number of faulty operation feature values whose difference from the evaluation target operation feature value is within the approximate range. The failure occurrence probability is calculated. The calculated failure occurrence probability indicates how many failures have occurred in the past due to the operation performed on the system to be evaluated, and the failure occurrence of the computer system due to the user's operation content. It is a probability.

  Therefore, according to the failure occurrence probability calculation system 1 of the present embodiment, it is possible to grasp the risk level of the computer system without knowing the cause of the failure. In addition, since the execution command indicates the operation performed by the operator on the computer system, problems that cannot be avoided even if the computer system is operating correctly, such as input errors and execution sequence errors, are also subject to system evaluation. can do. As a result, a manager who performs maintenance management of the system can present a fee considering not only the performance of the system but also the operating state of the system when estimating the maintenance fee.

  The present invention can be used for a technique for evaluating the contents of an operation on a computer system.

DESCRIPTION OF SYMBOLS 1 Failure occurrence probability calculation system 2-1 to 2-n Monitored computer system 3 Host system 11 Interface unit 12 Command collection unit 13 Command accumulation unit 14 Failure detection unit 15 Failure command history unit 16 Failure operation feature value calculation unit DESCRIPTION OF SYMBOLS 17 Data storage part at the time of failure 18 Information input part 19 Command history extraction means 20 Operation feature value calculation means 21 Failure number calculation means 22 Monitoring object information registration means 23 Monitoring object information storage part 24 Parameter calculation means 25 Failure occurrence probability calculation means 26 Disability number distribution table creation means

Claims (14)

Command collection means for collecting command history information indicating the execution command of the computer system to be monitored and its execution date and time;
A command storage unit for storing the collected command history information;
Fault detection means for detecting a fault in the monitored computer system;
When a failure of the computer system is detected by the failure detection means, a failure command history extraction means for extracting a history of commands executed by the computer system during a certain period immediately before the occurrence of the failure from the command storage unit;
The operation feature value calculation at the time of failure that calculates the operation feature value at the time of failure representing the feature of the command history based on the classification result by classifying the commands included in the extracted command history into a plurality of preset categories Means,
A failure data storage unit that accumulates the calculated failure operation feature values;
Operation feature value calculation for inputting an execution command history of a computer system to be evaluated and analyzing the command history in the same manner as the operation feature value calculation means at the time of failure to calculate an evaluation target operation feature value representing the feature of the command history Means,
A failure number calculation means for searching the information accumulated in the failure data storage unit to calculate the number of the failure operation feature values that are the same as or within the approximate range of the calculated evaluation target operation feature value;
Failure occurrence probability comprising failure occurrence probability calculating means for calculating failure occurrence probability of the computer system to be evaluated based on the number of operation characteristic values at the time of failure calculated by the failure number calculating means Calculation system. In the failure occurrence probability calculation system according to claim 1,
The failure operation feature value calculation means calculates at least one of the number of commands of each category specified as the command classification result as the failure operation feature value. system. In the failure occurrence probability calculation system according to claim 2,
A monitoring target information storage unit storing monitoring target information indicating identification information of the monitoring target computer system and its monitoring start date and time, and a monitoring period of the entire monitoring target computer system based on the stored monitoring target information And a parameter calculating means for calculating the total as a monitoring period,
The failure occurrence probability calculation means calculates a value obtained by dividing the number calculated by the failure number calculation means by the number calculated by the parameter calculation means as a failure occurrence probability of the evaluation target computer system. Failure occurrence probability calculation system. In the failure occurrence probability calculation system according to claim 3,
The failure operation feature value calculation means includes the command in three categories: a reference command for referring to system information / status, a change command for changing system information / status, and other commands. A failure occurrence probability calculation system characterized by classifying and calculating two values of the number of the reference commands and the number of the change commands as the operation characteristic values at the time of failure. Command collection means for collecting command history information indicating the execution command of the computer system to be monitored and its execution date and time;
A command storage unit for storing the collected command history information;
Fault detection means for detecting a fault in the monitored computer system;
When a failure of the computer system is detected by the failure detection means, a failure command history extraction means for extracting a history of commands executed by the computer system during a certain period immediately before the occurrence of the failure from the command storage unit;
The operation feature value calculation at the time of failure that calculates the operation feature value at the time of failure representing the feature of the command history based on the classification result by classifying the commands included in the extracted command history into a plurality of preset categories Means,
A failure creation probability calculation database creation system comprising: a failure data storage unit that accumulates the calculated failure operation feature values. An execution command history for a certain period of the computer system to be evaluated is input, and the commands included in the command history are classified into a plurality of preset categories, and the characteristics of the command history are expressed based on the classification result An operation feature value calculating means for calculating a target operation feature value;
A failure data storage unit that stores in advance a plurality of failure operation feature values representing features of a command history for a certain period immediately before the failure of the monitored computer system;
The number of the operation feature values at the time of failure that is the same as or within the approximate range of the operation feature value to be evaluated calculated by the operation feature value calculation means is calculated by searching the information stored in the data storage unit at the time of failure. The number of faults calculating means;
Failure occurrence probability comprising failure occurrence probability calculating means for calculating failure occurrence probability of the computer system to be evaluated based on the number of operation characteristic values at the time of failure calculated by the failure number calculating means Calculation device. The command collection means collects the command history information indicating the execution command of the computer system to be monitored and its execution date and stores it in the command storage unit,
A failure detection means detects a failure of the monitored computer system,
When a failure of the computer system is detected, a history of commands executed by the computer system in a certain period immediately before the occurrence of the failure is extracted from the command storage unit by the command history extraction unit at the time of failure,
A command included in the extracted command history is classified into a plurality of preset categories, and a faulty operation feature value representing a feature of the command history based on the classification result is calculated by a faulty operation feature value calculating unit. Calculate and accumulate in the data storage unit at the time of failure
An operation feature value calculation unit inputs an execution command history of the computer system to be evaluated, and performs an analysis process in the same manner as the operation feature value calculation unit at the time of failure to calculate an evaluation target operation feature value representing a feature of the command history,
The failure number calculation means searches the information accumulated in the failure data storage unit and calculates the number of failure operation feature values that are the same as or within the approximate range of the calculated evaluation target operation feature value,
A failure occurrence probability calculating method, wherein the failure occurrence probability calculating means calculates a failure occurrence probability of the computer system to be evaluated based on the calculated number of operation characteristic values at the time of failure. In the failure occurrence probability calculation method according to claim 7,
When the failure operation feature value is calculated by the failure operation feature value calculation means,
A failure occurrence probability calculating method, wherein at least one of the number of commands of each category specified as the command classification result is calculated as the failure operation feature value. The failure occurrence probability calculation method according to claim 8,
Before the failure occurrence probability calculating means calculates the failure occurrence probability,
Based on the monitoring target information indicating the identification information of the monitoring target computer system and the monitoring start date and time, the parameter calculation means calculates the total monitoring period of the entire monitoring target computer system as a total monitoring period,
When the failure occurrence probability calculating means calculates the failure occurrence probability,
A failure occurrence probability calculation method, wherein a value obtained by dividing the number calculated by the failure number calculation unit by the number calculated by the parameter calculation unit is calculated as the failure occurrence probability of the evaluation target. The failure occurrence probability calculation method according to claim 9,
When the failure operation feature value is calculated by the failure operation feature value calculation means,
The commands are classified into three categories: a reference command for referring to system information / status, a change command for changing system information / status, and other commands. A failure occurrence probability calculation method characterized by calculating two values of numbers as the failure operation feature values. A command collection function that collects command history information indicating the command executed on the system and the execution date and time from the computer system to be monitored and stores it in a storage device;
A failure detection function for detecting a failure of the monitored computer system;
When a failure of the computer system is detected by this failure detection function, a failure command extraction function that extracts a history of commands executed by the computer system from the storage device during a certain period immediately before the occurrence of the failure;
The commands included in the extracted command history are classified into a plurality of preset categories, and on the basis of the classification result, a faulty operation feature value representing the feature of the command history is calculated and stored in the storage device. Operation feature value calculation function at the time of failure,
An evaluation target operation feature that inputs an execution command history of the computer system to be evaluated and analyzes this command history in the same manner as the operation feature value calculation function at the time of failure and calculates an evaluation target operation feature value representing the feature of the command history Value calculation function,
A failure number calculation function for searching the information stored in the storage device and calculating the number of failure operation feature values that are the same as or within the approximate range of the calculated evaluation target operation feature value;
A failure occurrence probability calculation program for causing a computer to execute a failure occurrence probability calculation function for calculating a failure occurrence probability of the computer system to be evaluated based on the calculated number of operation characteristic values at the time of failure . In the failure occurrence probability calculation program according to claim 11,
The failure operation feature value calculation function is a function that calculates, as the failure operation feature value, at least one of the number of commands in each category specified as the command classification result. Occurrence probability calculation program. In the failure occurrence probability calculation program according to claim 12,
Based on monitoring target information indicating identification information of the monitoring target computer system and monitoring start date and time, together with a parameter calculation function for calculating the total monitoring period of the entire monitoring target computer system as a total monitoring period,
The failure occurrence probability calculation function is executed by the computer as a function of calculating a value obtained by dividing the number calculated by the failure number calculation function by the number calculated by the parameter calculation function as the failure occurrence probability of the evaluation target A failure occurrence probability calculation program characterized in that In the failure occurrence probability calculation program according to claim 13,
The failure operation feature value calculation function classifies commands into three categories: a reference command for referring to system information / status, a change command for changing system information / status, and other commands. And a failure occurrence probability calculation program including a function of calculating two values of the reference command number and the change command number as the failure operation feature value.

Images